With the maturity of Internet technologies and continuous popularization of services, the broadband access service has been developed rapidly. However, how to ensure the broadband users' security of using the broadband services and the security of network operators is a key problem to be solved. For example, an access user counterfeits a media access control (MAC) address of a broadband remote access server (BRAS) to initiate an application of point-to-point protocol over Ethernet (PPPoE) or dynamic host configuration protocol (DHCP), which causes a migration of a MAC address learning table of the broadband remote access server (BRAS) on an access equipment from a network-side port to a user-side port and thus results in the interruption of other users' services.
Considering the current development mode of the broadband service, a user accesses a network to use the broadband service in generally two manners, namely, PPPoE authentication and DHCP authentication.
The PPPoE protocol provides a broadband access means for a user using a bridged Ethernet to access, and meanwhile provides convenient access control and charging.
The DHCP protocol is put forward on the basis of a bootstrap protocol (BOOTP), and its function is to provide configuration information for a host in the network. The DHCP employs a client/server mode, in which a client initiates to a server a configuration application including an allocated IP address, a subnet mask, a default gateway and other parameters, and the server returns corresponding configuration information according to policies.
In order to solve the problem that a network-side MAC address is counterfeited, which results in that the service of other access users is interrupted, a source MAC address filter function is configured on the user-side port of the access equipment in the conventional art, i.e., a source MAC address filter table is manually configured on the user-side port of the access equipment to prohibit an access user from using a MAC address in the filter table as a source address. If the access user uses an address in the filter table, the access equipment discards the message.
As can be seen from the above method provided in the conventional art, when the BRAS is changed or an active BRAS at the network-side is handed over, the source MAC address filter table of the user-side port needs to be reconfigured. The configuration is dependent on a specific MAC address of an upper-layer network equipment, i.e., the source MAC address filter table stores the MAC address of the upper-layer equipment. If the upper-layer equipment is changed, the source MAC address filter table of the access equipment needs to be modified, which causes a large network administration and maintenance workload. Since a large number of access user ports exist, the source MAC address filter function is configured for the user-side ports one by one, which causes a large maintenance workload of the network administrator. Therefore, in the creation of the present invention, the inventor finds that the conventional art at least has the following problem: a source MAC address filter table needs to be configured manually on a user-side port of access equipment, which causes a large network administration and maintenance workload.